Experimenter's Freedom in Bell's Theorem and Quantum Cryptography 
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Bell's theorem states that no local realistic explanation of quantum mechanical predictions is 
possible, in which the experimenter has a freedom to choose between different measurement settings. 
Within a local realistic picture the violation of Bell's inequalities can only be understood if this 
freedom is denied. We determine the minimal degree to which the experimenter's freedom has 
to be abandoned, if one wants to keep such a picture and be in agreement with the experiment. 
Furthermore, the freedom in choosing experimental arrangements may be considered as a resource, 
since its lacking can be used by an eavesdropper to harm the security of quantum communication. 
We analyze the security of quantum key distribution as a function of the (partial) knowledge the 
eavesdropper has about the future choices of measurement settings which are made by the authorized 
parties (e.g. on the basis of some quasi-random generator). We show that the equivalence between 
the violation of Bell's inequality and the efficient extraction of a secure key — which exists for 
the case of complete freedom (no setting knowledge) — is lost unless one adapts the bound of the 
inequality according to this lack of freedom. 



I. INTRODUCTION 

Can the experimenter's free-will be experimentally 
tested? It seems unreasonable to expect that this ques- 
tion can be answered unconditionally. The philosophi- 
cal debate on whether or not our choices are ultimately 
up to ourselves or are just a predetermined illusion has 
lasted for centuries without reaching a final conclusion. 
Here we pursue our profession as physicists reminding 
ourselves of Einstein's words that "It is the theory which 
decides what we can observe". Thus, roughly speaking, 
one could say that it is the theory that decides whether 
or not the experimenter's free-will can be tested. Here we 
consider the experimenter's freedom of choosing between 
different possible measurement settings and argue that, 
within a local realistic theory, it can experimentally be 
tested. Following Gill et al. |lj this freedom will be de- 
fined as the independence of the experimenter's choice of 
measurement settings from the local realistic mechanism 
that determines the actual measurement results. 

The theorem of John Bell states the impossibil- 
ity of a local realistic explanation of quantum mechan- 
ics in which the experimenter has a freedom to choose 
between different experimental arrangements. This is 
demonstrated by the experimental confirmation of the vi- 
olation of Bell's inequalities in agreement with quantum 
mechanical predictions. The philosophical implications 
of Bell's theorem are startling: either one must abandon 
the experimenter's freedom, or the view that external 
reality exists prior to and independent of observations 
(realism), or dramatically revise our concepts of space 
and time (locality) . Needless to say, either of the choices 
requires radical revision of the ruling philosophical view 
of most of the scientists and is in sharp contrast to our 
every-day experience. 

If one chooses to keep a local realistic picture and to 



deny the experimenter's freedom, then one must accept 
a world in which the measurement settings that are gen- 
erated by the experimenter's choice (or by tossing a coin, 
or — to put it in a grotesque way — by the parity of the 
number of cars passing the laboratory within n seconds, 
where n is given by the fourth decimal of the cube of 
the actual temperature in degrees Fahrenheit) are deter- 
mined in advance and correlated with the actual outcome 
of the measurement. Bell himself comments such theories 
with the words 0: "A theory may appear in which such 
conspiracies inevitably occur, and these conspiracies may 
then seem more digestible than the non-localities of other 
theories. When that theory is announced I will not refuse 
to listen, either on methodological or other grounds. But 
I will not myself try to make such a theory." 

In this paper we show that the experimentally observed 
degree of violation of Bell's inequalities sets a minimal 
degree to which the free choice has to be abandoned if 
one insists on a local realistic explanation. Thus, not ev- 
ery local realistic theory denying free choice is in agree- 
ment with observations. Finally, extending the idea of 
Hwang [J, we argue that the experimenter's freedom can 
be considered as a resource in quantum communication 
as its lacking can be used by an eavesdropper to harm its 
security. We analyze the security in quantum key distri- 
bution as a function of the knowledge the eavesdropper 
has about the choice of measurement settings which is 
made by the authorized parties in the protocol. 



II. BELL'S INEQUALITIES WITH REDUCED 
EXPERIMENTER'S FREEDOM 



Realism supposes that the measurement results are de- 
termined by "hidden variables" which exist prior to and 
independent of observation. Locality supposes that the 
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results obtained at one location are independent of any 
measurements or actions performed at space-like sepa- 
rated regions. Finally, "freedom of choice" assumes that 
the experimenter's choice of the measurement setting is 
independent of the local realistic mechanism which de- 
termines the measurement results. In what follows we 
pursue the approach of Gill et al. pj in formulating these 
concepts in a mathematically rigorous way. 

Consider two spatially separated partners, Alice and 
Bob, performing space-like separated experiments on 
particles which are pairwise emitted by some source. Let 
X and Y denote the actual measurement outcomes ob- 
tained, and k and I the actual measurement settings cho- 
sen by Alice and Bob, respectively. The outcomes X and 
Y can take values +1 or —1, and the settings k and I val- 
ues 1 or 2. The probability to observe the two outcomes 
to be equal, X — Y, under the chosen k (Alice) and I 
(Bob) is denoted by P(X = Y\kl). 

Local realism assumes the existence of a quadruple of 
variables {Xi, Y\, Y2}, each taking values +1 or — 1, 
which represents the potential measurement outcomes in 
a thought experiment, under any of the possible mea- 
surement settings. This quadruple exists independently 
of whether any or which experiment is actually performed 
on either side. Because of locality the variables on Al- 
ice's side do not depend on the choice of setting on 
Bob's side, and vice versa. Thus, local realism requires 
X e {X 1 ,X 2 \ and Y € {Y U Y 2 }. 

The freedom assumption expresses the independence 
between the choice k, I of the measurement settings 
and the local realistic mechanism which finally se- 
lects the actual outcomes X, Y from the potential ones 
Xi, X2, Y\ , Y2. Gill et al. [jj put this formally in the 
requirement that {/c, 1} are statistically independent of 
{Xi, X2, Y"i, Y2}. This means that in many thought repe- 
titions of the experiment the probabilities with which the 
quadruple {Xi, X2, Y\, Y2} takes on any of its 2 4 possible 
values remain the same within each subensemble defined 
by the four possible combinations of k and I. In particu- 
lar, one has P(X k = Yi) = P(X = Y\kl), where P(X k = Y t ) 
is the (mathematical) probability for having Xk = Yt . 

What if the experimenter's freedom is just an illusion? 
Imagine that the choices of experimental settings and 
experimental results are both consequences of some com- 
mon local realistic mechanism. In such a case the two 
probabilities P(X k = Y t ) and P(X = Y\kl) may differ 
from each other and we use their difference 

A kl = P(X = Y\kl)-P(X k =Yi) (1) 

to measure the lack of freedom. This measure can ac- 
quire values from —1 to 1, and the freedom case cor- 
responds to all Aki = 0. It is important to note that 
while the probabilities P(X = Y\kl) can directly be 
measured, the P{X k = Y{) are only mathematical en- 
tities of the local realistic theory without a direct op- 
erational meaning. Nevertheless, they satisfy a set- 
theoretical constraint which is mathematically equivalent 
to the Clauser-Horne-Shimony-Holt (CHSH) inequal- 



ity The product of local realistic results X2Y2 is al- 
ways equal to the multiplication of (XiYi)(XiY 2 )(X 2 Yi), 
because the square of a dichotomic variable, with values 
+1 or —1, is equal to +1. This implies that the following 
expression can attain only one of two values 0: 

= Yi} + t{X x = Y 2 } 
+ t{X 2 = Y t } - 1{X 2 = Y 2 } = or 2 , (2) 

where t{X k = Y{\ is the indicator of the event X k = Yi, 
i.e., it is equal to 1 if it happens and if it does not 
happen. The expectation value of the indicator variable 
is the probability for the event to happen, P(X k = Y{). 
Finally the expectation value of the left-hand side can- 
not be greater than the maximum value of the averaged 
expression: 

Schsh = P{Xi =Y X ) + P(X 1 ^Y 2 ) 

+ P(X 2 = Y 1 )-P{X 2 = Y 2 )<2. (3) 

The equivalence to the CHSH inequality is evident as 
soon as one recalls that the correlation function of di- 
chotomic variables equals E k i = 2P(X k = Y{) — 1. The 
above inequality, in turn, implies a new bound on the set 
of probabilities that can experimentally be measured: 

S A = P(X = Y\11)+P(X = Y\12) (4) 
+ P{X = Y\2\) - P(X = Y\22) < 2 + A C hsh, 

where Achsh = An + A i2 + A 2 i — A 22 - Note that on the 
basis of measured probabilities (relative frequencies) one 
cannot make statements about the individual measures 
Afc; but rather on their combination as given in Achsh- 
In particular, it is possible that Achsh = 0, although 
all the individual A k i 7^ 0, and it may also be negative. 
However, only the case of positive Achsh — implying at 
least one individual A^; to be unequal to zero — makes 
the freedom assumption within a local realistic model 
experimentally testable, as the bound on the right-hand 
side of (0} is increased. As well one could study the lower 
bounds of Schsh an d 

To give an example of the lack of freedom model, 
imagine a local realistic mechanism in which the source 
"knows" in advance the settings "to be chosen" by Al- 
ice and Bob. The source can "arbitrarily" manipulate 
the value of Sa in this case. Even the algebraic (logical) 
bound of Sa = 3 can be reached: whenever Alice and 
Bob both measure the second setting, the source sends 
(local realistic) correlated pairs such that the measure- 
ment results anticoincide, i.e. P(X = Y\22) = 0, and in 
all other measurements it produces pairs for which the 
results coincide, i.e. P(X = Y\ll) = P(X = Y\12) = 
P(X = Y\21) = 1, and thus S A = 3. For this local real- 
istic model (without freedom) inequality (QJ is satisfied, 
but only because of the adapted bound 2 + Achsh = 3. 
Now imagine another experiment, in which the observers 
(freely) choose their settings independently from the lo- 
cal realistic source. Then P(X = Y\kl) = P(X k =Yi), i.e. 
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Achsh = 0, and inequality J2J is fulfilled with the bound 
of 2, as it becomes the CHSH inequality ©. 

The value of Aqhsh for which the inequality is still 
satisfied, defines the minimal extent to which the ex- 
perimenter's freedom has to be abandoned such that a 
local realistic explanation of the experiment is still pos- 
sible. Denote the left-hand side of inequality Q as the 
CHSH expression. The maximal possible quantum value, 
Sqm = 1 + \/2, of this expression can be observed for the 
maximally entangled state, for example, the singlet state 
\tp-) = (|0)|1) - \1)\0))/V2, where |0) and |1) are two or- 
thogonal quantum states, and for an appropriate choice 
of possible settings {k,l}. This quantum value requires 
an abandonment of the experimentalist's freedom to the 
extent of at least A C hsh = V2 - 1 w 0.414. 

Since, based on the experiment, we can only make 
statements about AqhsH: a large number of local real- 
istic theories are possible that deny the experimenter's 
freedom and are in agreement with quantum mechani- 
cal predictions and experiments. In order to be able to 
make further statements about these theories we need 
to impose some structure on them. In what follows we 
restrict ourselves to the case where the degree to which 
the freedom is abandoned — that is the absolute value 
of the measure A k i — is independent of the actual ex- 
periment performed, i.e. \Aki\ = A is the same for all 
k, I. Roughly speaking, the level of conspiracy is as- 
sumed to be the same for all experimental situations. 
Choosing An = A12 = A21 = — A22 = A one obtains 
A = \{s/2 — 1) ~ 0.104 for the minimal degree required 
to explain the quantum value of the CHSH expression by 
a local realistic model. If all the A/y are positive (i.e. if 
P(X = Y\kl) > P{X k ^Yi) for all fc,Z), one finds the even 
higher value A = ±(^2- 1) ~ 0.207. 

It is known that with an increasing number of parties, 
N, the discrepancy between the results of Bell tests and 
local realistic predictions that respect the experimenter's 
freedom increases rapidly (exponentially) with TV |(| . We 
now determine how the degree of the lack of freedom 
needs to scale with N in a local realistic theory that 
agrees with these tests. 

Consider TV space-like separated parties who can each 
choose between two possible measurement settings. Let 
S {1, — 1} denote the actual measurement result ob- 
tained and kj £ {1,2} the actual measurement setting 
chosen by party j. The probability to observe correla- 
tion, i.e. the probability that the product of local results 
is equal to 1 if settings k%, k^ are chosen, is denoted by 
P(n£Li^ (j ' 3 =l\ki...k N ). Local realism assumes the ex- 
istence of 2 N numbers {X^\x { ^\ x[ N) ,X^ N) }, each 
taking values +1 or —1 and representing the potential 
measurement outcomes of N parties under any possible 
combination of their measurement settings. The (math- 
ematical) probability that the product of the potential 

outcomes is equal to 1 is denoted by P(Y[jLi^k^ = Vl- 
Note again that this probability cannot be measured ex- 
perimentally. 



We apply the approach used above to the present case 
of N parties. We introduce the difference 

A kl ... kN = p(nf =1 xw=i| fcl ...fc JV ) - p(nf =1 4? =!) 

(5) 

to measure the lack of freedom of N experimenters. The 
probabilities P(Jlf=iXj?) = 1) satisfy a set-theoretical 
constraint that is mathematically equivalent to the Mer- 
min inequality [6( (the particular form used here is 
from 0): 

2 

m = s ^ ■■•< k ^ p (n7 =1 4f = 1) < B ( N ) , 

(6) 

where s(ki, kj^) = sin[(fci + ... + fcjv)fl are coeffi- 
cients taking values 0, +1 or —1. The inequality is 
bounded by B(N) = \ [2W 2 i +2 N / 2 sin(^f)] , where [^J 
is the greatest integer less or equal to x. Using inequal- 
ity © and definition (J5J, one obtains a new inequality: 

2 

M A = Yl s(k 1 ,...,k N )P(Y\f =1 X^ = l\k 1 ...k N ) 

k±,... ,/cjv — 1 

< B(N) + A M crm, (7) 

where A Mcrm = J2l u ...,k N =i s ( k i> -jfaf) A fel ... fcjv . Im- 
portantly, the probabilities entering this inequality are 
measurable. 

In a Bell experiment involving the maximally en- 
tangled iV-party (GHZ) state one observes Mqm = 
1 [2-W-1 + 2^/2 sin(^)] for the maximal possible value 
of the left-hand side of inequality Q). This implies 
2 n-2 _ 2 V(N-2)/2\ for the minima i va i ue of A Morm = 

■^QM — B(N) that still allows a local realistic explana- 
tion of the experiment. Suppose again that the degree 
of the lack of freedom is independent of the measure- 
ment setting. With an adequate choice of signs one has 
Ak 1 ...k N — Aat for k's for which s(k\, fcjv) = 1 and 
A/^...^ = — An for k's for which s(ki, fcjv) = — 1. This 
results in AMcrm = 2 n ~ 1 An. Finally, one obtains that 
the degree to which the experimenter's freedom has to be 
abandoned in order to have an agreement between local 
realism and Bell's experiments with N parties saturates 
exponentially fast with N as A^r = i — 2 i( N + 1 )/ 2 i ' ^ n ^ e 
limit of infinitely many partners Ajy reaches the value 
of \. It is remarkable that if the sign of all A^...^ is 
chosen positive, there will be no way to obtain agreement 
between local realism and the experimental results, since 
Ajv would have to leave the range from —1 to +1 in the 
limit of large N. The other argument which invalidates 
all Afc 1 ...fe JV to be positive involves only four parties. In 
this case in the expression defined in J7J the number of 
probabilities with a positive sign is equal to the number 
of probabilities with a negative sign. Thus, if all As^...^ 
are positive and have the same value they cancel each 
other, i.e. AMcrm = 0, and no explanation of the viola- 
tion of the bound B(N = 4) is possible. 
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In this section we showed that quantum correlations for 
N partners can be explained within local realism only if 
both the number of measurement settings in which the 
experimenter's freedom is abandoned (all 2 JV_1 combi- 
nations of local settings entering the Mermin inequality) 
increases exponentially and the degree of this abandon- 
ment saturates exponentially fast with N. Furthermore, 
from the viewpoint of local realism that denies freedom, 
there is no obvious reason why the quantum bound of 
the CHSH inequality is 1 + \/2 and not, for example, the 
maximal possible logical bound of 3. In our opinion these 
objections clearly show that the local realistic program 
goes squarely against every effort for simple and sensi- 
ble explanations of our observations. In particular, in 
order to explain the violation of Bell's inequality within 
local realism, one has to introduce purely theoretical and 
experimentally not accessible entities such as the (math- 
ematical) probabilities P(Xk =Y{). This is against the 
spirit of Ockham's razor principle. 



III. QUANTUM KEY DISTRIBUTION WITH 
REDUCED EXPERIMENTER'S FREEDOM 

The violation of Bell's inequality by legitimate parties 
was found to be a necessary and sufficient condition for 
their efficient extraction of a quantum secret key 0, , 
showing an appealing connection between secure key dis- 
tribution and the violation of local realism. 

Apart from its fundamental meaning, the freedom to 
choose between different measurement settings can be 
regarded as an important resource in quantum secret 
key distribution. In particular, as recently shown by 
Hwang an eavesdropper can both simulate the vi- 
olation of Bell's inequality and successfully eavesdrop, if 
the freedom in choosing the settings by legitimate part- 
ners is abandoned. Effectively, one can assume that each 
measurement device chooses its settings according to a 
pseudo-random sequence that is installed in the device 
beforehand. Such a model of lack of freedom allows 
the eavesdropper to know the algorithm generating the 
pseudo-random numbers, at least to some extent, and 
correspondingly predict the future measurement settings 
of the legitimate parties. 

In what follows we will consider an Ekert-like proto- 
col IHJ — a combination of the BBM92 protocol [lj 
(which is an application of the BB84 protocol to en- 
tangled states) and a CHSH test — and analyze both the 
violation of Bell's inequality and the security of the key 
distribution as a function of the amount of knowledge 
that the eavesdropper Eve (E) has about the settings 
chosen by the legitimate parties Alice (A) and Bob (B). 
We have chosen this combination of BBM92 and CHSH 
- henceforth denoted as the BBM-CHSH protocol - 
because it allows to test the relationship between Bell's 
theorem and secure quantum key distribution in a sin- 
gle protocol. (In contrast to the original Ekert protocol 
with non-orthogonal key establishing settings, there is a 
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FIG. 1: Settings in the BBM-CHSH protocol. Alice chooses 
between two orthogonal measurement directions «i and Q2, 
whereas Bob has four different possibilities, namely the same 
directions as Alice, i.e., f3\ and P2, as well as two directions 
rotated by j, i.e. 03 and 04. 



security proof for the BBM92 attached to the error rate.) 

Consider a source that emits pairs of spin-i particles 
in the singlet state \ip~) = (\z+)\z-) - \z-)\z+)) / 
where \z+) and \z—) denote spin-up and spin-down along 
the z-direction, respectively. The legitimate parties mea- 
sure the incoming particles in the x, y-plane. Alice can 
choose between two orthogonal settings, characterized 
by the azimuthal angles ai = and ui = § , whereas 
Bob has 4 possible measurement directions, namely f3\ = 
ai = 0, 02 = a 2 = § , /?3 = f , and f3± = (note that 
the Pj are not numbered in ascending order). Therefore, 
depending on their choice of settings, they sometimes 
measure correlations for determining the violation of the 
CHSH inequality, namely with the 4 settings (ai,/^), 
(ai,/?4), (a2,/?3), and (02, /3d), or they can establish a 
key, since their outcomes are perfectly anti-correlated for 
measurements along (ai,/3i) and (c^,/^)- If they choose 
(aiffa) ° r (&2,Pi), he. orthogonal directions, they dis- 
card their results. A schematic of the measurement di- 
rections is shown in figure ^ 

Let P(X = —Y\ij) denote the probability that Alice 
and Bob obtain anti-correlated results if they measure 
along ai and 0j, respectively, where i = 1,2 and j — 
1, 2, 3, 4. Within the freedom assumption the (measured) 
CHSH expression has the form 



S = P{X = -Y\13) + P(A = -y|23) 

+ P(X = -Y\2i)-P(X = -Y\U) < 2. 



(8) 



For the (maximally entangled) singlet state it is equal 
to 1 + v2- The classical bound is 2, whereas the logical 
bound is equal to 3. 

Let us now assume that an eavesdropper, Eve, has 
some knowledge about the choice of settings of Alice and 
Bob, for instance by having some insight into their ran- 
dom number generators. We model this knowledge in 
the following way: In each run, i.e., for each singlet pair, 
Eve knows that the combination of local settings (a*, 
will happen with probability qij. For simplicity we as- 
sume that one out of the 8 joint settings will happen with 
(high) probability Q > g, whereas all the others 7 have 
equal (low) probability to be manifested. The num- 



5 



ber Q shall be the same for all runs; the setting which it 
indicates to be most probable of course changes from run 
to run. The case Q = 1 corresponds to perfect knowledge 
of the eavesdropper and to the complete lack of free will 
of Alice and Bob, whereas Q = \ means that Eve has no 
knowledge at all. 

Now we impose the following attack algorithm: If Eve 
believes one of the CHSH settings to be most likely, she 
sends the corresponding optimal product state. In gen- 
eral, if qij — Q, which means that the setting (oti,pj) is 
most probable from Eve's viewpoint, she intercepts and 
sends either \a>i) A \j3j + n) B or \oti + ir) A \/3j} B (by toss- 
ing a fair coin, such that the local results of Alice and 
Bob are always totally random) . Only in the special case 
qu = Q, Eve sends |ai) A |/3 4 ) B or \ot\ + tt) a |/3 4 + n) B . 
This is the CHSH setting where the probability of anti- 
correlation should be minimized, since P(X = — Y | 14) ap- 
pears with a minus sign in the CHSH inequality There- 
fore, she attacks the CHSH measurements in order to 
achieve a maximal violation (S = 3) and the key estab- 
lishing measurements to find the key (or rather produce 
it herself). 

To further motivate why we have chosen this attack 
algorithm, we note that (i) it is canonical in the way that 
Eve attacks all events in the same way, namely with the 
appropriate product state, (ii) The attack is already good 
enough to show that the connection between violation of 
local realism and secure key distribution is lost in the case 
where the eavesdropper has partial knowledge about the 
settings, (iii) Eve sends a product state for each pair that 
is generated by the source; hence, Alice and Bob are faced 
with measurement results that can be described by local 
realism but nevertheless can violate the CHSH inequality 
© due to restricted freedom. 

According to Eve's setting knowledge and the attack 
strategy, one can compute the value for the CHSH expres- 
sion as measured by Alice and Bob. In the subensemble of 
cases where, e.g., Alice measures along a.\ and Bob along 
fa, Eve sends with probability Q the product states re- 
sulting in anti-correlations P(X = — Y"|13) = 1. In the 
rest of the cases she sends 7 possible "wrong guesses" 
which each happen with probability anc ] for each 
of them the probability for anti-correlations takes values 
between i and cos 2 ! « 0.854, depending on the specific 
wrong attack. The measured probability P(X = —Y\13) 
is the expectation value of all 8 sets of anti-correlated re- 
sults weighted with their probabilities to happen. Anal- 
ogously, the probabilities for anti-correlation in the other 
subensembles are calculated and we find 

P(X = -Y\13) = Q+ (f + 2 cos 2 f), (9) 

P(X = -Y\23) = P(X = -Y\13), (10) 

P{X = -Y\2A) = Q + i^S (| + cos 2 f + sin2 f )« ( U ) 

P(X = -F|14) = ±=2 (I +cos 2 f +sin 2 f). (12) 

The CHSH expression finally results in 

5 = 30+^(5 + 4 cos 2 !) W1.2 + 1.8Q. (13) 
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FIG. 2: (a) The (measured) CHSH expression S as a function 
of Eve's setting knowledge Q (solid line) . The CHSH inequal- 
ity @ with classical bound S c \ = 2 (dotted line) is violated 
for every setting knowledge Q > Q c \ w 0.44. The quantum 
bound Sqm = 1 + \/2 is also indicated, (b) The mutual in- 
formation between Alice and Bob 7ab (dashed line) and the 
actual mutual information between Bob and Eve /be (solid 
line), which is always smaller than (or equal to) the Alice-Eve 
mutual information. For every setting knowledge Q one has 
/be > /ab and thus Alice and Bob can never extract a secret 
key. An optimal attack without setting knowledge leads to 
/be (dotted line). Only for Q < Q » 0.63 the BBM-CHSH 
protocol is secure, because Alice and Bob find /ab < /be and 
they will not use their key. 



Thus, the logical bound <Si og = 3 is reached in the limit 
Q — > 1. The classical bound of S c i = 2 is beaten for all 
Q > Q c \ sa 0.44 and the quantum mechanics (Cirel'son) 
bound S qm = 1 + V2 « 2.41 is beaten for setting knowl- 
edge Q > Q qm w 0.67. If Q is larger than Q qm , Eve 
should reduce the strength of her attack, e.g. by mixing 
some noise into her product states, for otherwise even the 
quantum bound would be broken. The CHSH expression 
(|13fl and the bounds are shown in figure^- 

We can make the direct connection with section 
where now Eve plays the role of "conspiratorial" local 
realistic nature. Accordingly, we can introduce the differ- 
ence between the measured probabilities P(X — —Y\ij) 
and their mathematical (set constraint fulfilling) coun- 
terparts P(Xi = — Yj) to which the experimenter has no 
access. The latter are given by the first if one substitutes 
the value Q = | as this corresponds to the case where Eve 
has no setting knowledge and Alice and Bob are receiv- 
ing a classical mixture of equally weighted product states 
for each run: P(X i = -Y j ) = P(X = -Y\ij)\ Q=1/s . The 
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difference 

Aij = P(X = -Y\ij) - P(Xi = -Yi) (14) 

measures the lack of freedom. The set constraint fulfilling 
CHSH expression is 

Schsh = P(Xx = -Y 3 ) + P(X 2 = -Y 3 ) 

+ P(X 2 = -Y 4 )-P(X 1 = -Y 4 )<2, (15) 

and therefore 

S < 2 + Achsh , (16) 

where Achsh = A13 + A23 + A24 — A14. Inequality (|TB|) is 
fulfilled if and only if ljl5|l is fulfilled and this is the case 
because the (mathematical) probabilities P(Xi — — Yj) 
correspond to a mixture of product states and therefore 
obey local realism. 

When is Eve's knowledge about the settings also suf- 
ficient to find out the key which is established by Alice 
and Bob? To answer this question, we have to compute 
mutual informations between the parties. The mutual in- 
formation between Alice and Bob is determined by the bit 
error rate |3] which they can compute in the subensembles 
where they measured along oi\ — fi\ — or a 2 = fh = § • 
Let us consider the first; the error rate in the second is the 
same for symmetry reasons. The bit error rate D is given 
by the sum of 8 terms corresponding to the 8 settings 
that were potentially possible from Eve's point of view. 
Each term is the probability with which Eve believed this 
event would happen — Q for the event (ai, itself and 
iy2 f or a n the others (the wrong guesses), corresponding 
to our definition of the setting knowledge — multiplied 
with the probability that the attack (ai,/3j) leads to a 
correlation (error) rather than an anti-correlation as for 
the original singlet state. This "destruction probability" 
is for the "correct" event (ai,/?i), it is sin 2 ^ for both 
(aijPs) and (ai,/3 4 ), and ^ for all the others (where an 
orthogonal state was sent to Alice or Bob). Finally, we 
find the bit error rate 

D = i^2(| + 2sin 2 |) »0.4(1-Q). (17) 

The mutual information between Alice and Bob is 

7 AB = 1 - H{D) , (18) 

with H(p) = —plgp — (1 — p) lg(l — p) the Shannon en- 
tropy, where lg denotes the logarithm with base 2. 

The maximal mutual information between Alice (or 
Bob for symmetry reasons) and Eve from Alice's and 
Bob's viewpoint, which can be attained by an optimal 
attack of Eve for a given error rate D and under the con- 
dition that Eve has no setting knowledge, is given by |8( 

/ae = /be = 1 - H(± + Vd - D 2 ) . (19) 

The actual mutual information between Alice and Eve, 
Iaei can be computed from the conditional entropy Ha\e 



by Iae = Ha — ^a|Ej where Alice's Shannon information 
is .Ha = 1, since the outcomes of Alice are always locally 
random for all possible attacks. As all chosen settings 
are publicly revealed after the measurements, Eve can 
compute i?A|E m the subensemble of the key establishing 
measurement (ai,/?i). (If Alice and Bob measure along 
(c( 2 ,(3 2 ), the result does not change.) The calculation 
itself is straightforward, once one realizes that H^\ c = 
for all 4 events e in which Eve (justly) believed that Alice 
would choose a 4 , as Eve knows her result in this case. If 
Eve made the (wrong) guess a 2 then H^ c = 1 for these 
4 possible events, for Alice measures in the orthogonal 
direction ot\. Thus, -Ha|e = 4 and 

Z AE = l- 4i^ = f + fQ. (20) 

Analogously, one can find the actual mutual information 
between Bob and Eve: 

/be = 1-^2 (2 + 4iJ(cos 2 f)) S3 0.37 + 0.63 Q, (21) 

which is always smaller than (or equal to) Jae- Secret- 
key agreement between Alice and Bob using only er- 
ror correction and privacy amplification is possible if 
and only if the Alice-Bob mutual information is greater 
than the minimum of the Alice-Eve and Bob-Eve 
mutual information, that is, if and only if Jab > 
min(/AE j ^be) 0- We have 

Iab < Ibe (22) 

for all Q and equality only holds for Q = 1. Alice and 
Bob can never extract a secret key, since the condition 
Jab > ^be is never fulfilled (figure |2t>) • 

The well-known critical error rate Do = | (1 — -^) « 

0.15 corresponds, according to l|17|) . to a setting knowl- 
edge Qo ~ 0.63. For this knowledge Jab = ^be- If 
Q > Qo, the BBM-CHSH protocol is insecure, since 
7ab < ^be o-nd Alice and Bob find both their error rate 
to be sufficiently small (below Do) and the CHSH in- 
equality JSJ) to be violated, which makes them think they 
are safe. For Q < Qo Eve's setting knowledge is "in- 
sufficient" and the protocol becomes secure: Alice and 
Bob cannot extract a secret key because still Jab < ^be, 
but they find Jab < ^be and know that there might be 
an eavesdropper and thus they will not use the key. For 
0.44 « Q cl < Q < Qo w 0.63 they will find the CHSH in- 
equality ||SJ| to be violated (S > 2) and nonetheless they 
cannot extract a secret key (Jab < ^be, D > Do). There- 
fore, we deduce that the equivalence between the viola- 
tion of Bell's inequality (with complete freedom) and the 
secure key distribution (without freedom) is lost. (How- 
ever, the new bound in inequality l|16f) is never broken 
and, in fact, a secret key can never be extracted.) 

If Alice and Bob knew Q, which means they knew to 
which extent their freedom is restricted, and if they cal- 
culated the maximal Achsh under the constraint of an 
insecure key, Jab < niin(/AE ) ^be), for all possible at- 
tacks, then a violation of the CHSH inequality with the 
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new bound 2 + Achsh would be equivalent to the pos- 
sibility of efficient secret key extraction (unless the new 
bound is larger than S qm = 1 + y2)- A violation of 
this new bound is equivalent to statement that the clas- 
sical bound 2 is violated in the case of total freedom and 
for this situation there exists a complete equivalence be- 
tween the CHSH inequality violation and the security of 
the BBM protocol HQ. 

IV. CONCLUSIONS 

The violation of Bell's inequalities is an experimental 
fact. Within a local realistic program this fact can only 
be explained if the experimenter's freedom in choosing 
between different measurement settings is denied (mod- 
ulo known loopholes, considered by most scientists to be 
of technical nature) . For a local realist our results show 
that both the number of settings in which the freedom 
is abandoned grows exponentially and the degree of this 
abandonment saturates exponentially fast with the num- 
ber of parties. For the present authors, however, these 
results are rather an indication of the absurdity of the 
program itself. Nevertheless, they give rise to new se- 
curity criteria for quantum cryptography in situations in 



which the measurement settings chosen by the autho- 
rized parties are partially revealed by an eavesdropper. 
This contradicts the standard assumption in cryptogra- 
phy in which the laboratories of the authorized parties 
are safe and no relevant information is allowed to leak 
out from them. If this assumption is not fulfilled, we 
showed that the violation of the standard CHSH inequal- 
ity is not equivalent to a secure key distribution anymore. 
Nevertheless, it is possible to define a new (higher) bound 
whose violation indeed guarantees the security of the key. 
Therefore, one can keep the security while, to some ex- 
tent, relaxing the assumption that no information is re- 
vealed to an eavesdropper, as long as the amount of this 
information is known. 
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